Multipartite continuous- variable solution for the Byzantine agreement problem 
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We demonstrate that the Byzantine Agreement (detectable broadcast) is also solvable in the 
continuous-variable scenario with multipartite entangled Gaussian states and Gaussian operations 
(homodyne detection). Within this scheme we find that Byzantine Agreement requires a minimum 
amount of entanglement in the multipartite states used in order to achieve a solution. We discuss 
realistic implementations of the protocol, which consider the possibility of having inefficient ho- 
modyne detectors, not perfectly correlated outcomes, and noise in the preparation of the resource 
states. The proposed protocol is proven to be robust and efficiently applicable under such non-ideal 
conditions. 



I. INTRODUCTION 

An algorithm is commonly denned as a set of rules for 
solving a problem in a finite number of steps. One of the 
aims of quantum information is to provide new protocols 
and algorithms which exploit quantum resources to find 
a solution to problems which either lack a solution using 
classical resources or the solution is extremely hard to 
implement. The term "Byzantine Agreement" was orig- 
inally coined by Lamport & Fischer [l| in the context of 
computer science to analyze the problem of fault toler- 
ance when a faulty processor is sending inconsistent infor- 
mation to other processors. In a cryptographic context, 
it refers to distributed protocols in which some of the par- 
ticipants might have malicious intentions and could try 
to sabotage the distributed protocol inducing the hon- 
est parties to take contradictory actions between them. 
This problem is often reformulated in terms of a Byzan- 
tine army where there is a general commander who sends 
the order of attacking or retreating to each one of his lieu- 
tenants. Those can also communicate pairwise to reach 
a common decision concerning attacking or retreating, 
knowing that there might be traitors among them includ- 
ing the general commander. A traitor could create fake 
messages to achieve that different parts of the army at- 
tack while others retreat, which would put the army at a 
great disadvantage. The question hence is whether there 
exists a protocol among all the officials involved that, 
after its termination, satisfies the following conditions: 
The commanding general sends an order to his N — 1 
lieutenants such that: (i) all loyal lieutenant obey the 
same order (ii) if the commanding general is loyal, then 
every loyal lieutenant obeys the order he sends. It is as- 
sumed that the parties cannot share any previous setup. 
Lamport et al. [2| proved that if the participants only 
shared pairwise secure classical channels, then Byzan- 
tine Agreement or broadcast is only possible if and only 
if t < n/3 where n is the number of players and t is the 
number of traitors among them. In [3| Fitzi and cowork- 



ers introduced a weaker nevertheless important version of 
Byzantine Agreement known as detectable broadcast. De- 
tectable broadcast is said to be achieved if the protocol 
satisfies the following conditions: (i) if no player is cor- 
rupted, then the protocol achieves broadcast and (ii) if 
one or more players are corrupted, then either the pro- 
tocol achieves Byzantine Agreement or all honest players 
abort the protocol. Thus, in a detectable broadcast pro- 
tocol, cheaters can force the protocol to abort, i.e. no 
action is taken. In such cases all honest players agree on 
aborting the protocol so that contradictory actions be- 
tween the honest players are avoided. In the same paper 
Fitzi, Gisin and Maurer Q devised a solution to the 
detectable broadcast problem using multipartite entan- 
glement as a quantum resource. Later on Fitzi et al. [ij 
and Iblisdir and Gisin [f| showed that a Quantum Key 
Distribution (QKD) protocol, which guarantees a private 
sequences of classical data shared between pairs of par- 
ties, suffices to solve detectable broadcast. This situation 
is reminiscent of quantum cryptography, in which two 
seemingly independent main schemes exist for QKD, the 
prepare-and-measure Bennett and Brassart 1984 (BB84) 
scheme [!] which does not use entangled states shared 
between Alice and Bob, and the Ekert 1991 (Ekert91) 
scheme Q where indeed entanglement is explicitly dis- 
tributed and the security is guaranteed by Bell's theo- 
rem. However, the two schemes have been shown to be 
completely equivalent Q, and specifically entanglement 
stands as a precondition for any secure key distribution 
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Detectable broadcast might be regarded in a similar 
view as quantum key distribution and, arguably, the 
same reasoning applies to the different protocols ad- 
vanced for its solution, making explicit or implicit use 
of multipartite entanglement. In this paper, we adopt 
an approach of the Ekert91, guided by the physical mo- 
tivation of studying the performance and the usefulness 
of multipartite entangled states as operational resources 
to achieve detectable broadcast. While protocols for 
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this task exist for qutrits 3] and qubits [l(| HH, in 
this paper we investigate the possibility of solving de- 
tectable broadcast with continuous-variable (CV) sys- 
tems fl2l . [l3| , namely with Gaussian states and perform- 
ing Gaussian operations only. The motivations for this 
approach are manifold. On the practical side, the re- 
cent progress in CV QKD [14[ has shown that the use of 
efficient homodyne detectors, compared to photon coun- 
ters employed in BB84 schemes, enables the distribution 
of secret keys at faster rates over increasingly long dis- 
tances (TBj . On the theoretical side, multipartite entan- 
glement is a central concept whose understanding and 
characterization (especially in high-dimensional and CV 
systems), despite recent efforts, is far from being com- 
plete. It is important, therefore, to approach this task 
operationally, i.e. by connecting entanglement to the suc- 
cess or to the performance of diverse quantum informa- 
tion and communication tasks [161 ]. while exploiting the 
differences between discrete- variable and CV scenarios. 
For Gaussian states of light fields, which are presently 
the theoretical and experimental pillars of quantum in- 
formation with CVs [T3, EH, E3 ? an important result in 
this respect is due to van Loock and Braunstein [l8j |. 
They introduced a scheme to produce fully symmetric 
(permutation-invariant) n-mode Gaussian states exhibit- 
ing genuine multipartite entanglement. Furthermore, 
they devised a communication protocol, the "quantum 
teleportation network," for the distribution of quantum 
states exploiting such resources, which has been experi- 
mentally demonstrated for n = 3 The optimal fi- 
delity characterizing the performance of such a protocol 
yields an operational quantification of genuine multipar- 
tite entanglement in symmetric Gaussian states. This 
quantification is equivalent to the information-theoretic 
"residual contanglc" measure, a Gaussian entanglement 
monotone, emerging from the monogamy of quantum 



tic conditions, namely considering detectors with finite 
efficiency and yielding not perfectly matched measure- 
ment outcomes, and Gaussian resources which are not 
ideally pure, but possibly (as it is in reality) affected by 
a certain amount of thermal noise. We show that under 
these premises the protocol is still efficiently applicable to 
provide a robust solution to detectable broadcast over a 
broad range of the involved parameters (noise, entangle- 
ment, measurement outcomes, and uncertainties), paving 
the way towards a possible experimental demonstration 
in a quantum optical setting. 

The paper is organized as follows. In Sec. II we out- 
line the steps needed to solve detectable broadcast in the 
discrete scenario following [!, [l(|. In Sec. Ill, we first 
review briefly the basic tools needed to describe multi- 
partite Gaussian states and measurements. Building on 
the ideas presented in Section II we construct a protocol 
adapted to the continuous-variable case. In Sec. IV we 
discuss security on the distribution of quantum states for 
the protocol. Section V is devoted to analyze the effects 
of malicious manipulations of the data by dishonest par- 
ties and its detection by the honest ones. In Sec. VI 
we focus on the efficiency of the proposed protocol and 
we extend our results to a realistic practical scenario, re- 
laxing the conditions for obtaining of correlated outputs 
between the players and assuming noise in the prepara- 
tion of the input states. Finally, in Sec. VII we present 
our concluding remarks. 



II. DETECTABLE BROADCAST PROTOCOL 

The protocols to solve detectable broadcast using en- 
tanglement as a resource are based on three differentiated 
steps: 



correlations |20|, |21| . Other applications of multipartite (i) Distribution of the quantum states, 



Gaussian entanglement have been advanced and demon- 
strated, and the reader may find more details in [13, FPU . 
as well as in the two more recent complementary reviews 
[ItJ (theoretical) and [12] (experimental). In this respect, 
the usage of multipartite entangled Gaussian resources 
for the Byzantine Agreement problem was, to the best of 
our knowledge, not previously investigated. 

Here we propose a protocol to solve detectable broad- 
cast with symmetric multimode entangled Gaussian 
states and homodyne detection. This provides an alter- 
native interpretation of multipartite Gaussian entangle- 
ment as a resource enabling this kind of secure communi- 
cation. We concentrate on the case of three parties, and 
remarkably find that not all three-mode symmetric en- 
tangled Gaussian states are useful to achieve a solution: 
To solve detectable broadcast there is a minimum thresh- 
old in the multipartite entanglement. This is at variance 
with the two-party QKD counterpart: In there, all two- 
mode entangled Gaussian states are useful to obtain a 
secure key using Gaussian operations (23| . We eventually 
discuss how our protocol can be implemented in realis- 



(ii) Test of the distributed states, 

(iii) Protocol by itself. 

Step (iii) is fundamentally classical, since it uses the 
outputs of the different measurements of the quantum 
states to simulate a particular random generator ( "prim- 
itive"). Let us consider the simplest case, in which only 
three parties are involved. They are traditionally de- 
noted by S (the sender, i.e. commander general) and 
the receivers Rq and R\, and at most, only one is a 
traitor. In this case, the primitive generates for ev- 
ery invocation a random permutation of the elements 
{0,1,2} with uniform distribution, i.e. (tg, t^, tR r ) S 
{(0, 1, 2), (0, 2, 1), (1, 0, 2), (1, 2, 0), (2, 0, 1), (2, 1, 0)}. In 
this primitive, no single player n can learn more about the 
permutation than the value t n (n = {S, Rq, Ri}) which 
she or he, receives i.e., each player ignores how the other 
two values are assigned to the other players. Further- 
more, nobody else (besides the parties) have access to 
the sequences. 
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Entanglement is used in the protocol to distribute clas- 
sical private random variables with a specific correla- 
tion between the players, in such a way that any ma- 
licious manipulation of the data can be detected by all 
honest parties allowing them to abort the protocol. In 
the discrete variable case such a primitive can be im- 
plemented with qutrits using e.g. Aharonov states \A) = 
^(|0,1,2)+|1,2,0)+|2,0,1)-|0,2,1)-|1,0,2)-|2,1,0)). 
This choice allows the distribution and test part to be se- 
cure (for details see [3]). Whenever the three qutrits are 
all measured in the same basis, all three results are dif- 
ferent. Hence - after discarding all the states used for 
the testing of the distributed states [step (ii)] - the play- 
ers are left with a sequence of L outputs that reproduces 
the desired primitive. We schematically represent this 
primitive by the table below. 
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After accomplishing the distribution and test part of the 
protocol [steps (i) and (ii)], the sender S will broadcast 
a bit b e {0, 1} (0 = "attack", 1 = "retreat") to the two 
receivers using classical secure channels. 

Following the broadcast [step (hi)] proceeds as fol- 
lows: 

(iii-1): We denote by bi the bits received by Ri, i = 0, 1 
(notice that if the sender is malicious, the broadcasts 
bits bi could be different). Each receiver Ri demands to 
S to send him the indices j for which S obtained the 
result bi. Each player Ri receives a set of indices Ji. 
(iii-2): Each Ri test consistency of his own data, i.e. 
checks weather his output on the set of indices he 
receives (Ji) are all of them different from bi. If so the 
data is consistent and he settles his flag to c, = 
otherwise his flag is settled to c, =_L. 
(iii-3): Rq and Ri send their flags to each other. If 
both flags agree, the protocol terminates with all honest 
participants agreeing on b. 

(iii-4): If Cj =_L, then player Ri knows that S is dishon- 
est, the other player is honest and accepts his flag. 
(iii-5): If both Rq and R\ claim to have consistent data 
but Co ^ ci, player R\ demands from Rq to send him all 
the indices k € Jo for which Rq has the results 1 — cq. Ri 
checks now that (i) all indices k from Rq are not in J\ 
and (ii) the output R\ obtains from indices k correspond 
to the value 2. If this is the case, R\ concludes that Rq is 
honest and changes his flag to cq. If not, Ri knows that 
Rq is dishonest and he keeps his flag to c\. Detectable 
broadcast is in this way achieved. 



III. CONTINUOUS- VARIABLE PRIMITIVE 

Before describing in detail how to achieve the prim- 
itive presented in the above section in the CV set up, 
let us briefly review the most basic ingredients needed 
to describe Gaussian states [IH, Oj} ■ We consider here 
quantum systems of n canonical degrees of freedom, often 
called modes, associated to a Hilbert space n = L 2 (5i 2 ™). 
The commutation relations fulfilled by the canonical co- 
ordinates R T = (Xi,Pi, . . . , X n , P n ) — (Ri . . . , R,2n) are 
represented in matrix form by the symplectic matrix J: 
[R a , R b ] = i( J n )ab, with a, b = 1, . . . , 2n, and 



Jn — ®i = \J 



J = 




(1) 



Gaussian states are, by definition, completely described 
by their first and second moments. Hence, rather than 
describing them by their (infinite-dimensional) density 
matrix p, one can use the Wigner function representation 



w p (0 = 



i 



exp[-(C-d) T 7 _1 (C-d)] (2) 



which is a function of the first moments through the dis- 
placement vector d (a 2n real vector), and of the second 
moments through the covariance matrix 7 (a 2nx 2n sym- 
metric real matrix). Here £ € K 2n is a phase-space vec- 
tor. The positivity condition of p implies that 7+1 J n > 0. 

Following the discussion of the protocol [step (iii)] 
for the discrete case, we choose to use as a resource a 
pure, fully inseparable tripartite Gaussian state p a , com- 
pletely symmetric under the interchange of the modes 
[18j, whose covariance matrix 7(a) accepts the following 
parametrization [24| : 



7(a) 



with a > 1 and 



/a0c0c0\ 

b -c -c 
c a c 
-c b -c 
c c a 
V -c -c b J 



7 (5a- y/9a 2 - 8), 



(3) 



-(a- V9a^ 



(4) 
(5) 



The condition for full inseparability (truly multipartite 
entanglement) across the lxlxl mode partition comes 
from the nonpositivity of the partial transpose (NPT- 
criteria) and reads |24j ]: 

J + U A t 
j + iJb t 
7 + iJc It 
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with J A = J T ffiJffiJ, J B = J®J T ®J, J c = J©J©J T . 
It follows that 7(a) is fully inseparable as soon as a > 1. 
Quantitatively, the genuine tripartite entanglement of 
the states of Eq. ([3]), as measured by the residual contan- 



gle |21j , is a monotonically increasing function of a and 
diverges for a — > 00. 

So far 7(a) appears as the "equivalent" CV version 
of the discrete Aharonov state \A), i.e. fully insepa- 
rable and completely symmetric under exchange of the 
three players. One is tempted to infer, therefore, that the 
discussed primitive of the discrete case can be straight- 
forwardly generalized to the continuous one. A stan- 
dard way of transforming the correlations of the shared 
entangled quantum states p a into a sequence of classi- 
cally correlated data between the 3 players is to per- 
form a homodyne measurement of the quadratures of 
each mode. Denoting by Xs, X Ro , X Rl the position 
(or momentum) operator of each mode, and by xs, x Ro , 
x Rl the output of the respective measurement, the play- 
ers can communicate classically with each other and 
agree, for instance, only on those values for which cither 
\%s\ = \ X R \ = l^-fli I = {0,^o} with x Q > 0. In this way 
each player can associate the logical trit (t = 0, 1, 2) to a 
null, positive, or negative result, respectively. The prob- 
ability distribution that measuring the quadratures Xs, 
X Ro , X Rl produces an outcome t$ = j, t Ro = k, t Rl = I, 
with (j, k, I) € {0, 1, 2} and uncertainty a is given by: 



V(j,k,l) = Tr (p M ' fe '<>p ) (6) 
= (2tt)" / W { J- k - l} (0W a (0d 2n t 



Here p$' 1 



/5g S_J © PR°~ k ® Pri~ 1 describes the sepa- 
rable state of the 3 modes obtained after each party has 
measured its corresponding quadrature and obtained an 
output j,k,l. Thus, the state of the system after the 
measure can be described by a fully separable covariance 
matrix 7m, 



7m 



( 7m 



V 





Irn 
7 m 



(7) 



where each party has a pure one-mode Gaussian state 
with covariance matrix 



(8) 




modified when adapted to the CV scenario. The way we 
find to overcome this asymmetry of the output's prob- 
abilities relics on joining the correlations from pairs of 
quantum states. First we map the quantum correlations 
involved in each single quantum state just to classical bits 
by a "sign binning" (as in CV QKD |23|]). That is, first we 
keep only the results for which the three players obtain a 
coincident output \xs\ — |^ij | ~ \ x Ri\ — > 0, and as- 
sociate the logical bit b n = 0(1), where n — {S, Rq, Ri}, 
to positive (negative) value of the coincident quadrature 
xq(-xo). In every measurement the sender makes pub- 
lic his outcome result |xo|j whatever the output is, but 
not its sign in such a way that in principle all states are 
going to be used in the protocol. Second, we construct 
a primitive consisting of a random permutation of the 
elements (i,j,k) G {(0, 1, 1), (1, 0, 1), (1, 1, 0)}. Compul- 
sory for the implementation of the primitive is that every 
element of the primitive appears with equal probability 
and any other combination of the outputs not regarded 
by the primitive is exceedingly small compared to the 
allowed permutations. In other words, we demand that 
p = V{0, 1, 1) = V(l, 0, 1) = V(l, 1, 0), and, denoting by 
S = Vielse), we require that the corresponding condi- 
tional probabilities, 



/ P(b s ,b Ro ,b Rl ) = 



V(b s ,b Ro ,b Rl ) 
£i,j,fe={o,i} V{j, k, I) 



fulfill p 



I and S — > 0. 



If the above conditions are met, it is possible then by 
invoking two consecutive times the previous generator 
[i.e. using a pair of quantum states of the class Eq. ©J, 
to map the bit values to trit-values (0,1,2) plus an ad- 
ditional undesired element "it" . For instance, the play- 
ers, after keeping only those bits obtained by coincident 
quadrature outputs ±xo, use two consecutive bits m and 
m + 1 for the following association: 



(1,0) 

(0,1) 

(1,1) 

(0,0)- 
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2 



and displacement vector <i m = (— |xo|,0). On the other 
hand W a is the Wigner function of the initial tripartite 
entangled state p a described by 7(a) and d. 

Since Gaussian states are symmetric with respect to 
their displacement vector, it is easy to see that a mapping 
into classical trits such that all possible outputs {0, 1, 2} 
occur with the same probability is not possible. There- 
fore, the primitive discussed in the discrete case must be 



Thus, by concatenating two invocations, one gener- 
ates the permutations corresponding to the primitive 
{(0, 1, 2), (0, 2, 1), (1, 0, 2), (1, 2, 0), (2, 0, 1), (2, 1, 0)} plus 
a permutation of undesired elements (u, 2, 2), (2, u, 2), 
(2,2,u) which will be discarded during the protocol. 
With all these tools at hand, optimal results for the de- 
sired probabilities are achieved for a displacement vector 
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of the form (F = -^(1,0,1,0,1,0), and yield: 



5i = -P(l,l,l) = C(a,tT)exp 



8 2 = -P(0,0,0) = C(a,CT)exp ( - 
*3 



4sg 
3^i 
16 xl 



3 K x 

7>(0,0,1) = 7>(0,1,0) =-p(l,0,0) 



(9) 



C(a, a) x exp 



-Ax 2 ((T 2 + i [5a- V9a 2 -8J) 



and 



p = P(0,1 ! 1)=P(1,0,1)=P(1,1,0) 

^ N (10) 



C M exp(-5g-) 



with coefficients i-Ci = cr 2 + | [3a — -\/9a 2 — 8j , = 
cr 2 + i [3a + V9a 2 — 8j , and prefactor 




FIG. 1: (Color online) Plot of the conditional probability p 
as a function of the measurement outcome xo and the shared 
entanglement a, for pure symmetric tripartite Gaussian re- 
source states. Detectable broadcast is ideally solvable in the 
huge, unbounded region of 10 > 0, a > 1, where p — > 1/3. 
The entanglement threshold a = a t hresh = 5\/2/6 is depicted 
as well (wireframe surface). All of the quantities plotted are 
dimensionless. 



dct 



7m + 7( a ) 



(a- 



(a + 2c + a 2 )(b-2c+ 4,) 



The probability distribution depends on the parameters 
a, xo and cr. In the case a 3> 1, it can be seen that the 
conditional probabilities satisfy the following: 



0(k 2 







(11) 



with k = exp [— f(^) 2 ]- In the limit of a perfect, zero- 
uncertainty homodyne detection (cr — > 0), p converges 
exactly to 1/3. In general, there exists a large region in 
the parameters space for which p — > i and <5i — * 0, as 
depicted in Fig. [TJ 

However, there is a lower bound on the entanglement 
content of the symmetric Gaussian states of Eq. ((3]) in or- 
der to fulfill the above conditions. Only for a > a t hresh = 
■^-2 « 1.18, one has that p > §i, which is a necessary 
condition to implement the primitive. This indicates 
that not all pure three-mode symmetric full entangled 
Gaussian states can be successfully employed to solve 
detectable broadcast via our protocol. This entangle- 
ment threshold is an a priori bound which does not de- 
pend on the specific form of the employed resource states. 
For any parametrization of the covariance matrix of p a , 
which is obtainable from 7(a) by local unitary squeez- 
ing transformations (hence at fixed amount of tripartite 
entanglement), the same condition discriminating useful 
resource states is analytically recovered. We remark that 
this bound becomes tight in the limit xq — * 00, meaning 
that a > athresh becomes necessary and sufficient for the 
successful implementation of the primitive. 



IV. DISTRIBUTION AND TEST 

We move now to the distribution & test part of the 
protocol which represents the first step in the execution 
of the appropriate primitive and has only two possible 
outputs: Global success or global failure. In the case of 
failure, a player assumes that something went wrong dur- 
ing the execution of the protocol and aborts any further 
action. In the case of global success, each of the parties 
ends up with a set {K} of classical data, and the protocol 
proceeds classically, according to the steps explained in 
Section II. 

From now on we assume that the players share pair- 
wise secure classical channels and secure (noiseless) quan- 
tum channels. The secure distribution & test part uses 
correlations to validate the fairness of the other par- 
ties. Therefore, quantum states are sent through noise- 
less quantum channels and measures are performed mas- 
sively. In doing so, it is possible to detect manipulation 
of the data on a statistical basis and abort the protocol if 
necessary. In this Section we mostly focus on the issue of 
security in the distribution and security test of the data. 
This should permit the detection of any malicious ma- 
nipulation of the data. The explicit effects of sabotage 
actions will be reported in Section V. We postpone the 
important issue of how well the protocol will succeed in 
the case that the outputs of the measurements are not 
perfectly correlated to Section VI. The reader not inter- 
ested in the detailed description of the distribution & test 
part can skip the rest of this section and jump to Section 
V or VI instead. 

The distribution & test part proceeds as follows: 
(i-1) Without losing generality, let us assume that i?i pre- 
pares a large number, M, of tripartite systems in state 
p a (i.e. with covariance matrix 7(a) and displacement d) 
and sends one subsystem to S and another to Rq. 
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(i-2) Ri wants to check if the distribution of states is 
faithfully achieved. To this aim she or he chooses ran- 
domly a set of indices for player 5, {K~s}, and a dis- 
joint set of indices for player Rq, {Kr }, and sends these 
two sets over secure classical channels to the correspond- 
ing players. Player S sends his or her {K~s} subsystems 
to player Rq. For each m £ {Kg}, Rq measures the 
two subsystems in his or her possession and R\ mea- 
sures his subsystem. After communication of their re- 
sults over secure classical channels, they agree on those 
indices {Ks} Q Kg for which \xr q \ = \x& x \ — x Q . R 1 and 
Ro check now whether the correlations predicted by the 
primitive occur: p = P(011) = P(101) = V(110) = §, 
S = 0. If the test was successful, i.e. if the measure- 
ment results were consistent with the assumption that 
the states have been distributed correctly, the players 
i € {Ro, Ri} set the flag fi = 1, otherwise fa — 0. In an 
analogous way, the test is performed for S. 
(i-3) Players S, Rq and Ri send their flags to each other. 
Every player who receives a flag "0", sets his flag also 
to "0" . Every player with flag "0" aborts the protocol. 
Otherwise, the execution of the protocol proceeds. This 
step terminates the distribution & test of the quantum 
systems. 

In the second phase of the protocol a selection of the 
distributed systems is chosen to establish the bit se- 
quences which will be used to implement the quantum 
primitive. In this phase, again honest parties may abort 
the protocol if malicious manipulations occur. 
(ii-1) The players S, Rq and R\ agree upon a set of sys- 
tems which have not been discarded during the distribu- 
tion & test part. 

(ii-2) Player S chooses (randomly) two disjoint sets of 
subsystems labeled by indices L s C M. He or she sends 
the set L l s to player i and demands player i to send via a 
noiseless quantum channel his or her subsystems m G L' s 
to him or her. In each case, the (random) choice L s 
is secret to party j, i.e. player R\ has no information 
whatsoever about the set L R ° . An analogous procedure 
is adopted by Rq and R\. 

(ii-3) After measuring their whole sequence of subsys- 
tems, player i £ {S,Rq,R\} announces publicly, the 
set of indices {M™} € M$ for which the output of the 
quadrature measurement was |xo| The order in which 
the players announce their measurement results can be 
specified initially and based, e.g. on a rotation princi- 
ple. (Notice that the announcement of \xi\ — xq during 
the actual measurement phase would make possible an 
effective traitor strategy, since he could manipulate com- 
binations on a systematic basis). 

(ii-4) Without loss of generality, let us explicitly describe 
this step of protocol for player S. From the following sets 
Lf°nM£ =: Uf 1 and L^HMQ =: Ug° let U^' C 
for i 6 {0, 1} be the index set for which the player S mea- 
sured ±xo twice. Analogously to the first phase of the 
protocol, player S can test if the outputs of his mea- 
sures agree with the correlations of a proper primitive 
(p(0Q) = p(10) = p(01) = 1/3 and p(ll) = 0) If the test 



is successful, the player sets his flag fg = 1, otherwise 
fs = 0. The same procedure is analogously performed 
by Rq and From this step on, the players deal exclu- 
sively with the outputs of their measures, i.e. classical 
data and secure classical channels. 

(ii-5) S checks correlation on his outputs in the following 
set M := Mf n M™ o n MjjJ C M<p. If the test is suc- 
cessful, S sets his flag fs = 1, otherwise fs = 0. Rq and 
Ri do the equivalent step. 

(ii-6): From a randomly chosen set V s C M player S 
demands from Rq and i?i their measurement results. S 
tests this control sample for the assumed primitive. If the 
test is successful, S sets his flag fg = l, otherwise f$ = 0. 
Rq (Ri) perform this step with a set V R ° C M\V S 
(V Rl C M\(V S U V Rq )) respectively. 
(ii-7) Every player with a flag aborts the execution of 
the protocol. Otherwise the players agree upon a set 
W := M\(V S U V Ro U V Rl ) as the result of the invoca- 
tion of the primitive, which consists in an even number 
of elements. This step concludes the distribution part of 
the protocol. 

V. ERROR ESTIMATION 

We examine here two possible sources of error, which 
can occur during the implementation of the primitive 
with Gaussian states. While the first source is inherent 
to the system, the second is caused by an active adver- 
sary intervention of a participating party. The inherent 
error is caused by the occurrence of non consistent com- 
binations on the invocation of the primitive, that is, the 
occurrence of outputs (1,1,1), (0,0,0), (0,0,1), (0,1,0) 
and (1, 0, 0) has to be considered. This error will propa- 
gate along the protocol, so that the probability of finding 
a combination which is not appropriate is bounded from 
above from 77 = 1 — (3p) 2 . 

The second source of errors we want to discuss here 
corresponds to the local actions that one of the players 
could do in order to manipulate the measurement results 
of other players. For instance, let us assume that the 
player Rq has malicious intentions and wants to shift the 
local component of the displacement vector of the dis- 
tributed state using local transformations. Note that a 
shift of the quadrature output x Q , provides the same error 
in the probability distribution of the outputs as a shift in 
the corresponding displacement vector. In other words, 
both types of manipulations produce the same change in 
the probabilities as calculated in Eq.©. Parameterizing 
the shift in the displacement vector by the parameter K 7 
d T i-> (d') T = -^(1, 0,1,0, K, 0), it is interesting to see 

how that affects the conditional probabilities p and S. If 
probabilities were changed, player Rq could try to de- 
termine [via subsequent communication with the other 
players (step ii-3)], with certain probability, the occur- 
rence of the outputs of the other players, thereby gaining 
additional information. Notice also that S and R\ can- 
not realize the local manipulation of Rq without classi- 
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cal communication between them. This can be trivially 
seen by realizing that the partial trace Tr^ (/3 a (7, d')) = 
J W^dx Ro dp Ro = frs,^, ds,^) = Tr flo (/5 a (7, d)) with 



7S,-Ri = 



fa 





b 


\ -c 



— c 

b 



and d 







S,Ri 







V o J 



(12) 

Thus the most plausible strategy for a traitor could con- 
sist of the following: (i) Discrediting honest players by 
manipulating the displacement vector in such a way that 
non consistent combinations appear, (ii) hide successful 
measurements to the honest players which result in com- 
binations that might be disadvantageous. It is tedious 
but straightforward to show that by making use of the 
test steps (ii-4) — (ii-6) honest parties can detect the effects 
of such manipulations. 



VI. EFFICIENT REALISTIC 
IMPLEMENTATION 

The protocol, as discussed in the previous Sections, 
constitutes a nice proof-of-principle of the fact that de- 
tectable broadcast is solvable in the CV scenario using 
multipartite Gaussian entanglement. However, it suffers 
from its reliance on two main idealizations which render 
the practical implementation of the primitive unrealistic, 
or, better said, endowed with zero efficiency. Specifically, 
we have requested that (i) a pure tripartite symmetric 
Gaussian state is distributed as the entangled resource; 
and (ii) when the three parties measure (via homodyne 
detection) the position of their respective modes, their 
measurement is taken to be ideal, that is not affected by 
any uncertainty, and moreover all parties must obtain, up 
to a sign, the same outcome xq. In reality, assumption (i) 
is unjustified as inevitable imperfections and losses result 
instead in the production of mixed, thermalized states; 
on the other hand, the probability associated to (ii), and 
hence the probability of achieving broadcast, is vanish- 
ingly small [25| . It is interesting, in view of potential 
practical implementations of our scheme, to study here 
how its success is affected, and possibly guaranteed, by 
relaxing the above two assumptions. 

To deal with (i), let us recall that the tripartite en- 
tangled Gaussian states of Eq. ([3]) can be produced in 
principle by letting three independently squeezed beams 
(one in momentum, and two in position) interfere at 
a double beam splitter, or "fritter" [26|, as proposed 
by van Loock and Braunstein [l8j . In practice, the 
parametric nonlinear process employed to squeeze the 
vacuum is affected by losses which result in the ac- 
tual generation of squeezed thermal states in each single 
mode. Before the fritter, one then has three independent 
Gaussian modes with covariance matrices 7j"(s,n) = 
diagjns, n/s}, ^{s^n) = 73 n (s,n) = diag{n/s, ns}, re- 
spectively, where s = exp(2r) (with \r\ the squeezing 



degree in each single mode) and n > 1 is the noise pa- 
rameter affecting each mode. The noise n is related to 
the initial marginal purity /j,™ of each single mode by 
n = 1/jU? (2?| . and corresponds to a mean number of 
thermal photons given by n th — (n — l)/2. For n = 1, 
each mode is in the ideally pure squeezed vacuum state. 
After the fritter operation, described by the symplectic 
matrix [H, [H, Hl| 



T = 
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the output covariance matrix of the three modes is given 
precisely by 

7 out = T . [7 in (S; n) 7 in (Sj n) 7 i„ (Sj n)] . T T = ^ ^ 

where 7(a) is defined in Eq. ^ and we have made the 
identification a = [(s 2 + 2) /(3s)]. Eq. (fT3"| describes 
generally mixed, fully symmetric three-mode Gaussian 
states, with global purity given by fi = n~ 3 , thus reduc- 
ing to the pure instance of Eq. ([3]) for n = fi = 1. Recall 
that any additional losses due e.g. to an imperfect fritter 
and/or to the distribution and transmission of the three 
beams can be embedded into the initial single-mode noise 
factor n, so that Eq. (fTB"]) provides a realistic description 
of the states produced in experiments [H, [29[ . We there- 
fore consider this more general family of Gaussian states 
as resources to implement the CV version of the prim- 
itive. It may be interesting to recall that also for the 
general family of states of Eq. (fT"3f the genuine tripartite 
entanglement is exactly computable [281 ] in terms of the 
residual contangle [2ll ] , and as expected, it increases with 
a and decreases with n. 

Concerning the idealization (ii) discussed above, for an 
efficient implementation we should first consider the real- 
istic case of nonideal homodyne detections, which means 
that the outcomes are affected by uncertainties quanti- 
fied by the parameter a, see Eq. ©. Furthermore, we 
should let the parties measure within a finite range, which 
means specifically that in each measurement run the ex- 
pected values for the measurement outcomes of the re- 
ceivers can be shifted of some quantity A with respect to 
the corresponding expectation value of the sender's ho- 
modyne detection. So, what we should ask for is that 
the parties (one sender S and two receivers Rq and i?i) 
agree on those outcomes of their measurement results for 
which \xs\ = xq > and \x Ra \ = \x Rl \ = (x + A) > 0, 
once the sender has announced his or her output results 
xq to the other two parties. Here, the actual results of 
each measurement are assumed to distribute according to 
a Gaussian function centered at x$ (for the sender) and 
xq + A (for the receivers), respectively, with a variance a. 
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Now the associated events occur with a finite probabil- 
ity. We wish to investigate for which range of the positive 
shift A e [A min , A max ], being A max -A min the range, the 
conditional probability p still approaches 1/3. The wider 
such range, the higher the probability of success, or effi- 
ciency, of the protocol; of course the regions in the space 
of parameters such that the primitive can be efficiently 
implemented will depend on the specific boundaries A m ; n 
and A max and not only on their difference. Notice that 
in order to ensure that the sign of the quadratures does 
not change when allowing a finite range of valid output 
values (and therefore, correlations between classical bits 
are properly extracted (see Sec. Ill)), we always demand 
the shift A to be positive. This condition can be further 
relaxed allowing for a non-symmetric range of permitted 
values around the broadcasted value xq . This extra con- 
dition, which could be straightforwardly included in our 
expressions if one aims at maximizing the efficiency of 
our protocol, does not modify the analysis of the real- 
istic implementation of the protocol we perform in this 
Section. For the sake of clarity, we remark once again the 
role of the parameter A: Allowing a nonzero shift A in 
the computation of the probability p, means considering 
the realistic case in which the outcomes of the measure- 
ments performed by each receiver can be not coincident 
with each other, and not coincident even with the corre- 
sponding broadcasted value of \xo\- In what follows we 
show that the protocol can be run successfully provided 
that the deviations \xr \ — \xs\ and {xr^ — \xs\ (in each 
run) both lie in between a A m ; n and a A max , which will 
be determined. 

To this aim, we can perform an analysis similar to the 
one of Section III, but considering in full generality a 
non-unit noise factor n, a non-zero uncertainty a, and 
a non-zero shift A. The calculations of the probabilities 
follow straightforwardly along the lines of the special (un- 
realistic) case previously discussed, and we finally obtain 

{4(A + a= )[A(4<T 2 + 7a-3H) + (4 CT 2 +3a + H) a : ] 
3 _|_ 3e 3(4<,4 +9a „2_ R „2 +4) 

4i [4(a-H)A+(4tr 2 +9[i-5H)i () ] 
_|_ g 3(4CT 4 +9a<r 2 -Rcr' 2 +4) 

32(A + x )[A(<T 2 +a) + (<T 2 + H)x Q ] ~| ~~ 1 
_|_ g 3(4 CT 4 4-9a<r 2 -R<T 2 + 4) I (14) 

with R = i/9a 2 — 8. We find that in the parameter 
space of a (regulating the entanglement), n (regulat- 
ing the mixedness), xo (regulating the measurement out- 
come), a (regulating the measurement uncertainty), and 
A (regulating the measurement shift), there exists a sur- 
face which acts as the boundary for the regime in which 
our primitive can be faithfully implemented, yielding a 
feasible, robust solution to the broadcast problem. This 
surface is obtained by requiring that p = 1/3 — e, with the 
deficit e chosen arbitrarily small. The result is plotted in 
Fig. [2] for e = 1CP 7 in the three-dimensional space of pa- 
rameters xo/y/n, A/y/n, and a, for different values of a. 



We consider the primitive as efficiently implementable in 
the whole region such that 1/3 — e < p < 1/3, which 
spans the volume above the surface of Fig. [2l Notice 
that for a = 0, n = 1, and A max — > A m j n — * 0, such 
a useful volume shrinks to a two-dimensional slice (with 
a > 5\/2/6) which represents the parameter range in 
which the "ideal" implementation described in Sec. Ill 
is successful. 

The figure offers several reading keys. Let us inves- 
tigate independently how the possibility of solving de- 
tectable broadcast via our protocol depends on the in- 
dividual parameters. For simplicity, we will consider n 
fixed and eventually discuss its role. We will also for 
the moment keep the idealization of error-free homodyne 
measurements (a — 0), corresponding to Fig. HJa): this 
makes the subsequent discussion more tractable. How- 
ever we will relax such an assumption in the end to show 
that a realistic description of the homodyne measurement 
does not significantly affect the performance and the ap- 
plicability of the protocol. This validates the claims of 
efficiency that we make in the following. 

Let us henceforth start with the dependence of the 
solution on a. Somehow surprisingly, there exist lower 
and upper bounds on the tripartite entanglement such 
that only for a m j n < a < a max the protocol achieves a 
solution. The bounds naturally depend on xq and A. 
Specifically, we observe that a m i n diverges for A = 
and xq — ► 0, meaning that no feasible solution can be 
achieved in the low-A, low-xo regime; the reason being 
that near xq = there is not possibility of associating 
the classical bits "0" and "1" to positive/negative values 
of the quadrature. The lower bound then goes down 
reducing to the already devised threshold of athresh = 
5\/2/6 for A close to zero and xo ^> 0, and eventually 
converges to a = 1 (i.e. all entangled states are useful) for 
any finite x^ 3> and A — > oo. On the other hand, the 
upper bound on a, which surprisingly rules out states 
with too much entanglement, is obviously diverging at 
A = but becomes finite and relevant in the regime of 
small £0 and large A, eventually reducing to 3/2 for any 
finite xo and A — > oo. 

Summarizing, the two extremal regimes corresponding 
to A = on the one hand and A — > oo on the other hand, 
both allow a solution of detectable broadcast via our pro- 
tocol: The main difference is that in the former case one 
needs states with an entanglement above a m j n = 5^/2/6, 
while in the latter case one needs states whose entan- 
glement is below a max = 3/2. The regime of finite shift 
A interpolates between these two limits. This means, in 
terms of useful range, and hence of efficient implemen- 
tations, that if one is able to produce entangled states 
precisely with 5\/2/6 < a < 3/2, the protocol is imple- 
mentable with high efficiency for any shift A 6 [0, oo) in 
the measurement outcomes, i.e. with an infinite range 
of variability allowed for the acceptable data resulting 
from homodyne detections performed by the receivers, 
for a given outcome xq of the sender. This information 
is important in view of practical implementations, and 
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FIG. 2: (Color online) Plots, in the space of xo/^/n (quadrature measurement normalized to noise), A/^/n (measurement shift 
normalized to noise), and a (shared entanglement), of the boundary to the useful region for which p = 1/3 — e (e = 10 -7 ), 
at different values of the homodyne detection uncertainty (a) ff = (ideal error-free measurement), (b) a = 1 (fixed error, 
independent of the outcome), and (c) a — |a:o|/10 (proportional error, corresponding to a 90% efficiency in the detectors). 
Detectable broadcast can be solved efficiently, by means of our protocol, for all values of the parameters which lie above the 
depicted surface. See text for an extended discussion. All of the quantities plotted are dimensionless. 



becomes especially valuable since the engineering of the 
required entangled resources appears feasible: A squeez- 
ing between 4.5 and 6 dB is required in each single mode, 
which is currently achieved in optical experiments [30|. 

Fig. [U^a), alternatively, shows that for a fixed entan- 
gled resource, a, there exist minimum thresholds both 
for xq and A in order to achieve a solution to detectable 
broadcast. While the useful range for xq is always un- 
bounded from above, we find that, interestingly, an up- 
per bound A max exists for a > 3/2. Precisely, for a given 
a > 3/2, with increasing xq we observe that A m j n de- 
creases and A max increases, i.e. the useful range spanned 
by A widens. Conversely, at a given xq, A max decreases 
with increasing entanglement a, reducing the parameter 
space in which a solution can be found. Consistently with 
the previous discussion, we conclude again that in real- 
istic conditions (A > 0) it is better to have a moderate 
amount of shared entanglement to solve broadcast with 
optimal chances. 

Now, let us note that the noise parameter n simply 
induces a rescaling of both xq and A, in such a way that 
with increasing n the surface bounding the useful range 
of parameters shrinks, as it could be guessed (the noise 
degrades the performance of the protocol). Still, with 
typical noise factors characterizing experimental imple- 
mentations, e.g. n = 2, the protocol appears very robust 
and the solution is still achievable, for a given amount 
of entanglement (say a < 3/2), provided that xq and 
A exceed y/2 times their respective minimum thresholds 
obtained for ideally pure resources (n = 1). 

Finally, let us address the important issue of the un- 
certainty affecting homodyne detections. Any realistic 
measurement is characterized by a nonzero a. We have 
explicitly studied two situations, one in which the ab- 
solute error is fixed, corresponding to a constant a [see 
Fig. HJb)] , and another in which the relative error is fixed, 
corresponding to a a proportional to the measurement 



outcome xq [see Fig. [2fc)]. The result is that, in both 
cases, for not exceedingly high values of the error fac- 
tor, the useful region is obviously reduced but, crucially, 
the possibility of achieving detectable broadcast via our 
protocol is still guaranteed in a broad range of values of 
the parameters. Specifically, as somehow expected, the 
error model in which a is proportional to the measure- 
ment outcome results in a more consistent modification 
(shrinkage) of the useful surface, while almost nothing 
happens in the case of fixed, small a. In particular, up- 
per bounds on xq arise for a practical realization in the 
presence of a proportional error, or in other words due 
to a limited efficiency in the detection. A significant por- 
tion of the parameter space anyway remains valid for a 
workable implementation of the primitive. Our scheme is 
thus robust also with respect to the imperfections in the 
quadrature measurements. We draw the conclusion that 
the protocol we designed is truly efficient and realistically 
implementable in non-ideal conditions. 

Fig. [3] explicitly depicts p, Eq. (|14[) . for sensible re- 
source values of a = 3/2 and n = 2, as a function of 
xq and A, and according to different values of a like in 
Fig. [21 We notice a huge (unbounded from above in the 
ideal case a = 0) region in which p — > 1/3, yielding an 
efficient solution to detectable broadcast via our proto- 
col. We have thus identified an optimal "work point" in 
terms of the parameters describing the shared Gaussian 
states, and we have defined the frontiers of application 
of our scheme in the laboratory practice. In this way, 
together with the explicit steps of the protocol presented 
in the preceding sections, we obtain a clear-cut recipe 
for a CV demonstration of detectable broadcast, which 
we hope can be experimentally implemented in the near 
future. 

For the sake of completeness, let us mention that from 
Eq. (|14[) we analytically find that p converges exactly to 
1 /3 only in the following limiting cases (for a given finite 
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FIG. 3: (Color online) Plots of the conditional probability p, Eq. (|14|l . as a function of the measurement outcome xo for the 
sender and the shift A of the measurement outcomes for the receivers, for realistically mixed Gaussian resource states with n = 2 
and a — 3/2. The uncertainty in the homodyne detection is taken to be (a) a = 0, (b) a = 1, and (c) a = [xq|/10. Detectable 
broadcast is efficiently solvable in the wide plateau region where p — > 1/3. All of the quantities plotted are dimensionless. 



n and a = 0): (i) a 
with a > 5V2/6; (iii) 



— > oo with A < 3iro; (ii) xq 
A -> oo with 1 < a < 3/2. 



VII. CONCLUDING REMARKS 

In this paper we have proposed a protocol to solve de- 
tectable broadcast with entangled continuous variables 
using Gaussian states and Gaussian operations only. Our 
algorithm relics on genuine multipartite entanglement 
distributed among the three parties, which specifically 
must share two copies of a three-mode fully symmetric 
Gaussian state. Interestingly, we have found that never- 
theless not all entangled symmetric Gaussian states can 
be used to achieve a solution to detectable broadcast: 
A minimum threshold exists on the required amount of 
multipartite entanglement. We have moreover analyzed 
in detail the security of the protocol. 

In its ideal formulation, our protocol requires that the 
parties share pure resource states, and that the outcomes 
of homodyne detections are perfectly coincident and not 
affected by any uncertainty; this however entails that our 
protocol achieves a solution with vanishing probability. 
To overcome such a practical limitation, we have eventu- 
ally considered a more realistic situation in which the tri- 
partite Gaussian resources are affected by thermal noise, 



and, more importantly, the homodyne detections are re- 
alistically imperfect, and there is a finite range of allowed 
values for the measurement outcomes obtained by the 
parties. We have thoroughly investigated the possibil- 
ity to solve detectable broadcast via our protocol under 
these relaxed conditions. As a result, we have demon- 
strated that there exists a broad region in the space of 
the relevant parameters (noise, entanglement, measure- 
ment range, measurement uncertainty) in which the pro- 
tocol admits an efficient solution. This region encom- 
passes amounts of the required resources which appear 
attainable with the current optical technology (with a 
legitimate trade-off between squeezing and losses). We 
can thus conclude that a feasible, robust implementa- 
tion of our protocol to solve detectable broadcast with 
entangled Gaussian states may be in reach. This would 
represent another important demonstration of the use- 
fulness of genuine multipartite continuous-variable en- 
tanglement for communication tasks, coming to join the 
recent achievement of a quantum teleportation network 
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